diff --git a/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml b/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml
new file mode 100644
index 0000000000000..b8c29079d472b
--- /dev/null
+++ b/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage-nightly.yaml
@@ -0,0 +1,85 @@
+base_images:
+  tls-scanner-tool:
+    name: tls-scanner
+    namespace: tls-scanner
+    tag: tls-scanner-tool
+build_root:
+  image_stream_tag:
+    name: eco-ci-cd
+    namespace: telcov10n-ci
+    tag: eco-ci-cd
+releases:
+  latest:
+    candidate:
+      product: ocp
+      stream: nightly
+      version: "5.0"
+resources:
+  '*':
+    limits:
+      cpu: 500m
+      memory: 4Gi
+    requests:
+      cpu: 500m
+      memory: 200Mi
+tests:
+- as: e2e-telcov10n-nrop-tests-5-0-nightly
+  capabilities:
+  - intranet
+  cron: 0 12 * * 0
+  reporter_config:
+    channel: '#eco-ci-cd-notifications'
+    job_states_to_report:
+    - failure
+    - error
+    - success
+    - aborted
+    report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}*
+      ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed:
+      Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs>
+      {{end}}'
+  steps:
+    env:
+      CLUSTER_NAME: helix47
+      OCP_VERSION_RELEASE_TYPE: nightly
+      OPERATORS: |
+        [
+          { "name": "numaresources-operator", "catalog": "numaresources-operator-fbc", "og_name": "numaresources-operator", "nsname": "openshift-numaresources", "deploy_default_config": false, "fbc_iib_repo": "latest", "channel": "5.0", "ocp_operator_mirror_fbc_image_base": "quay.io/redhat-user-workloads/telco-5g-tenant/numaresources-operator-fbc-5-0" }
+        ]
+      TEST_ENV: stage
+      VERSION: "5.0"
+    workflow: telcov10n-functional-cnf-compute-nrop-testing
+- as: e2e-telcov10n-nrop-tls-scanner-5-0-nightly
+  capabilities:
+  - intranet
+  cron: 0 8 * * 0
+  reporter_config:
+    channel: '#eco-ci-cd-notifications'
+    job_states_to_report:
+    - failure
+    - error
+    - success
+    - aborted
+    report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}*
+      ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed:
+      Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs>
+      {{end}}'
+  steps:
+    env:
+      CLUSTER_NAME: hlxcl9
+      OCP_VERSION_RELEASE_TYPE: nightly
+      OPERATORS: |
+        [
+          { "name": "numaresources-operator", "catalog": "numaresources-operator-fbc", "og_name": "numaresources-operator", "nsname": "openshift-numaresources", "deploy_default_config": false, "fbc_iib_repo": "latest", "channel": "5.0", "ocp_operator_mirror_fbc_image_base": "quay.io/redhat-user-workloads/telco-5g-tenant/numaresources-operator-fbc-5-0" }
+        ]
+      PQC_CHECK: "true"
+      SCAN_NAMESPACE: openshift-numaresources
+      SCANNER_CPU: "2"
+      TEST_ENV: stage
+      VERSION: "5.0"
+    workflow: telcov10n-functional-cnf-compute-nrop-tls-scanner
+zz_generated_metadata:
+  branch: main
+  org: openshift-kni
+  repo: eco-ci-cd
+  variant: cnf-compute-nrop-stage-nightly
diff --git a/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml b/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml
index e7fb072214f7a..f7a0fc461ee4e 100644
--- a/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml
+++ b/ci-operator/config/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main__cnf-compute-nrop-stage.yaml
@@ -12,21 +12,6 @@ resources:
       cpu: 500m
       memory: 200Mi
 tests:
-- as: e2e-telcov10n-nrop-tests-5-0-nightly
-  capabilities:
-  - intranet
-  cron: 0 12 * * 0
-  steps:
-    env:
-      CLUSTER_NAME: helix47
-      OCP_VERSION_RELEASE_TYPE: nightly
-      OPERATORS: |
-        [
-          { "name": "numaresources-operator", "catalog": "numaresources-operator-fbc", "og_name": "numaresources-operator", "nsname": "openshift-numaresources", "deploy_default_config": false, "fbc_iib_repo": "latest", "channel": "5.0", "ocp_operator_mirror_fbc_image_base": "quay.io/redhat-user-workloads/telco-5g-tenant/numaresources-operator-fbc-5-0" }
-        ]
-      TEST_ENV: stage
-      VERSION: "5.0"
-    workflow: telcov10n-functional-cnf-compute-nrop-testing
 - as: e2e-telcov10n-nrop-tests-stage-4-22
   capabilities:
   - intranet
diff --git a/ci-operator/jobs/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main-periodics.yaml b/ci-operator/jobs/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main-periodics.yaml
index f67f0d921942e..a4d18f1468ad1 100644
--- a/ci-operator/jobs/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main-periodics.yaml
+++ b/ci-operator/jobs/openshift-kni/eco-ci-cd/openshift-kni-eco-ci-cd-main-periodics.yaml
@@ -3000,7 +3000,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 12 * * 0
+  cron: 0 0 * * 4
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3013,7 +3013,7 @@ periodics:
     ci-operator.openshift.io/variant: cnf-compute-nrop-stage
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-5-0-nightly
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-14
   spec:
     containers:
     - args:
@@ -3021,7 +3021,7 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-5-0-nightly
+      - --target=e2e-telcov10n-nrop-tests-stage-4-14
       - --variant=cnf-compute-nrop-stage
       command:
       - ci-operator
@@ -3074,7 +3074,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 0 * * 4
+  cron: 0 12 * * 4
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3087,7 +3087,7 @@ periodics:
     ci-operator.openshift.io/variant: cnf-compute-nrop-stage
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-14
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-16
   spec:
     containers:
     - args:
@@ -3095,7 +3095,7 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-stage-4-14
+      - --target=e2e-telcov10n-nrop-tests-stage-4-16
       - --variant=cnf-compute-nrop-stage
       command:
       - ci-operator
@@ -3148,7 +3148,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 12 * * 4
+  cron: 0 0 * * 5
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3161,7 +3161,7 @@ periodics:
     ci-operator.openshift.io/variant: cnf-compute-nrop-stage
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-16
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-18
   spec:
     containers:
     - args:
@@ -3169,7 +3169,7 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-stage-4-16
+      - --target=e2e-telcov10n-nrop-tests-stage-4-18
       - --variant=cnf-compute-nrop-stage
       command:
       - ci-operator
@@ -3222,7 +3222,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 0 * * 5
+  cron: 0 12 * * 5
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3235,7 +3235,7 @@ periodics:
     ci-operator.openshift.io/variant: cnf-compute-nrop-stage
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-18
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-19
   spec:
     containers:
     - args:
@@ -3243,7 +3243,7 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-stage-4-18
+      - --target=e2e-telcov10n-nrop-tests-stage-4-19
       - --variant=cnf-compute-nrop-stage
       command:
       - ci-operator
@@ -3296,7 +3296,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 12 * * 5
+  cron: 0 0 * * 6
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3309,7 +3309,7 @@ periodics:
     ci-operator.openshift.io/variant: cnf-compute-nrop-stage
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-19
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-20
   spec:
     containers:
     - args:
@@ -3317,7 +3317,7 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-stage-4-19
+      - --target=e2e-telcov10n-nrop-tests-stage-4-20
       - --variant=cnf-compute-nrop-stage
       command:
       - ci-operator
@@ -3370,7 +3370,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 0 * * 6
+  cron: 0 12 * * 6
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3383,7 +3383,7 @@ periodics:
     ci-operator.openshift.io/variant: cnf-compute-nrop-stage
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-20
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-21
   spec:
     containers:
     - args:
@@ -3391,7 +3391,7 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-stage-4-20
+      - --target=e2e-telcov10n-nrop-tests-stage-4-21
       - --variant=cnf-compute-nrop-stage
       command:
       - ci-operator
@@ -3444,7 +3444,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 12 * * 6
+  cron: 0 0 * * 0
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3457,7 +3457,7 @@ periodics:
     ci-operator.openshift.io/variant: cnf-compute-nrop-stage
     ci.openshift.io/generator: prowgen
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-21
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-22
   spec:
     containers:
     - args:
@@ -3465,7 +3465,7 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-stage-4-21
+      - --target=e2e-telcov10n-nrop-tests-stage-4-22
       - --variant=cnf-compute-nrop-stage
       command:
       - ci-operator
@@ -3518,7 +3518,7 @@ periodics:
         secretName: result-aggregator
 - agent: kubernetes
   cluster: build07
-  cron: 0 0 * * 0
+  cron: 0 12 * * 0
   decorate: true
   decoration_config:
     skip_cloning: true
@@ -3528,10 +3528,23 @@ periodics:
     repo: eco-ci-cd
   labels:
     capability/intranet: intranet
-    ci-operator.openshift.io/variant: cnf-compute-nrop-stage
+    ci-operator.openshift.io/variant: cnf-compute-nrop-stage-nightly
     ci.openshift.io/generator: prowgen
+    job-release: "5.0"
     pj-rehearse.openshift.io/can-be-rehearsed: "true"
-  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-e2e-telcov10n-nrop-tests-stage-4-22
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-nightly-e2e-telcov10n-nrop-tests-5-0-nightly
+  reporter_config:
+    slack:
+      channel: '#eco-ci-cd-notifications'
+      job_states_to_report:
+      - failure
+      - error
+      - success
+      - aborted
+      report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}*
+        ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed:
+        Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View
+        logs> {{end}}'
   spec:
     containers:
     - args:
@@ -3539,8 +3552,9 @@ periodics:
       - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
       - --lease-server-credentials-file=/etc/boskos/credentials
       - --report-credentials-file=/etc/report/credentials
-      - --target=e2e-telcov10n-nrop-tests-stage-4-22
-      - --variant=cnf-compute-nrop-stage
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=e2e-telcov10n-nrop-tests-5-0-nightly
+      - --variant=cnf-compute-nrop-stage-nightly
       command:
       - ci-operator
       env:
@@ -3561,6 +3575,9 @@ periodics:
       - mountPath: /etc/boskos
         name: boskos
         readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
       - mountPath: /secrets/gcs
         name: gcs-credentials
         readOnly: true
@@ -3581,6 +3598,103 @@ periodics:
         - key: credentials
           path: credentials
         secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
+    - name: manifest-tool-local-pusher
+      secret:
+        secretName: manifest-tool-local-pusher
+    - name: pull-secret
+      secret:
+        secretName: registry-pull-credentials
+    - name: result-aggregator
+      secret:
+        secretName: result-aggregator
+- agent: kubernetes
+  cluster: build07
+  cron: 0 8 * * 0
+  decorate: true
+  decoration_config:
+    skip_cloning: true
+  extra_refs:
+  - base_ref: main
+    org: openshift-kni
+    repo: eco-ci-cd
+  labels:
+    capability/intranet: intranet
+    ci-operator.openshift.io/variant: cnf-compute-nrop-stage-nightly
+    ci.openshift.io/generator: prowgen
+    job-release: "5.0"
+    pj-rehearse.openshift.io/can-be-rehearsed: "true"
+  name: periodic-ci-openshift-kni-eco-ci-cd-main-cnf-compute-nrop-stage-nightly-e2e-telcov10n-nrop-tls-scanner-5-0-nightly
+  reporter_config:
+    slack:
+      channel: '#eco-ci-cd-notifications'
+      job_states_to_report:
+      - failure
+      - error
+      - success
+      - aborted
+      report_template: '{{if eq .Status.State "success"}} :slack-green: Job *{{.Spec.Job}}*
+        ended with *{{.Status.State}}*. <{{.Status.URL}}|View logs> {{else}} :failed:
+        Job *{{.Spec.Job}}* ended with *{{.Status.State}}*. <{{.Status.URL}}|View
+        logs> {{end}}'
+  spec:
+    containers:
+    - args:
+      - --gcs-upload-secret=/secrets/gcs/service-account.json
+      - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+      - --lease-server-credentials-file=/etc/boskos/credentials
+      - --report-credentials-file=/etc/report/credentials
+      - --secret-dir=/secrets/ci-pull-credentials
+      - --target=e2e-telcov10n-nrop-tls-scanner-5-0-nightly
+      - --variant=cnf-compute-nrop-stage-nightly
+      command:
+      - ci-operator
+      env:
+      - name: HTTP_SERVER_IP
+        valueFrom:
+          fieldRef:
+            fieldPath: status.podIP
+      image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+      imagePullPolicy: Always
+      name: ""
+      ports:
+      - containerPort: 8080
+        name: http
+      resources:
+        requests:
+          cpu: 10m
+      volumeMounts:
+      - mountPath: /etc/boskos
+        name: boskos
+        readOnly: true
+      - mountPath: /secrets/ci-pull-credentials
+        name: ci-pull-credentials
+        readOnly: true
+      - mountPath: /secrets/gcs
+        name: gcs-credentials
+        readOnly: true
+      - mountPath: /secrets/manifest-tool
+        name: manifest-tool-local-pusher
+        readOnly: true
+      - mountPath: /etc/pull-secret
+        name: pull-secret
+        readOnly: true
+      - mountPath: /etc/report
+        name: result-aggregator
+        readOnly: true
+    serviceAccountName: ci-operator
+    volumes:
+    - name: boskos
+      secret:
+        items:
+        - key: credentials
+          path: credentials
+        secretName: boskos-credentials
+    - name: ci-pull-credentials
+      secret:
+        secretName: ci-pull-credentials
     - name: manifest-tool-local-pusher
       secret:
         secretName: manifest-tool-local-pusher
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/configure/telcov10n-functional-cnf-compute-nrop-configure-commands.sh b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/configure/telcov10n-functional-cnf-compute-nrop-configure-commands.sh
index ce4834d06f467..5167ad4bf7898 100644
--- a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/configure/telcov10n-functional-cnf-compute-nrop-configure-commands.sh
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/configure/telcov10n-functional-cnf-compute-nrop-configure-commands.sh
@@ -52,3 +52,8 @@ echo "Copy must gather to artifacts directory"
 scp -r -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /tmp/temp_ssh_key \
     "${BASTION_USER}@${BASTION_IP}":/tmp/wip/artifacts/* "${ARTIFACT_DIR}"
 
+echo "Copy kubeconfig to SHARED_DIR for TLS scanner"
+scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /tmp/temp_ssh_key \
+    "${BASTION_USER}@${BASTION_IP}":/home/telcov10n/project/generated/${CLUSTER_NAME}/auth/kubeconfig \
+    "${SHARED_DIR}/kubeconfig"
+
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/OWNERS b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/OWNERS
new file mode 100644
index 0000000000000..42fcae862b9e3
--- /dev/null
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/OWNERS
@@ -0,0 +1,7 @@
+approvers:
+- eifrach
+- ccardenosa
+- mrniranjan
+- rshemtov13
+- sargunnarula
+- oblau
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-commands.sh b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-commands.sh
new file mode 100755
index 0000000000000..d583a2ab679b9
--- /dev/null
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-commands.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+set -o nounset
+set -o errexit
+set -o pipefail
+
+CI_REGISTRY_PULL_SECRET="/var/run/ci-registry/.dockerconfigjson"
+
+if [[ ! -f "${CI_REGISTRY_PULL_SECRET}" ]]; then
+    echo "CI registry pull secret not found at ${CI_REGISTRY_PULL_SECRET}, skipping"
+    exit 0
+fi
+
+echo "Merging CI registry credentials into cluster global pull-secret..."
+
+oc -n openshift-config get secret pull-secret -o jsonpath='{.data.\.dockerconfigjson}' | base64 -d > /tmp/cluster-pull-secret.json
+
+python3 -c '
+import json, sys
+with open("/tmp/cluster-pull-secret.json") as f:
+    cluster = json.load(f)
+with open(sys.argv[1]) as f:
+    ci = json.load(f)
+cluster.setdefault("auths", {}).update(ci.get("auths", {}))
+with open("/tmp/merged-pull-secret.json", "w") as f:
+    json.dump(cluster, f)
+' "${CI_REGISTRY_PULL_SECRET}"
+
+oc set data secret/pull-secret -n openshift-config --from-file=.dockerconfigjson=/tmp/merged-pull-secret.json
+
+rm -f /tmp/cluster-pull-secret.json /tmp/merged-pull-secret.json
+
+echo "CI registry credentials merged into cluster global pull-secret"
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-ref.metadata.json b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-ref.metadata.json
new file mode 100644
index 0000000000000..7118432ef38a6
--- /dev/null
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-ref.metadata.json
@@ -0,0 +1,13 @@
+{
+	"path": "telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-ref.yaml",
+	"owners": {
+		"approvers": [
+			"eifrach",
+			"ccardenosa",
+			"mrniranjan",
+			"rshemtov13",
+			"sargunnarula",
+			"oblau"
+		]
+	}
+}
\ No newline at end of file
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-ref.yaml b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-ref.yaml
new file mode 100644
index 0000000000000..57c775f7209e0
--- /dev/null
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/merge-ci-credentials/telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-ref.yaml
@@ -0,0 +1,21 @@
+ref:
+  as: telcov10n-functional-cnf-compute-nrop-merge-ci-credentials
+  from: cli
+  cli: latest
+  commands: telcov10n-functional-cnf-compute-nrop-merge-ci-credentials-commands.sh
+  env:
+  - name: KUBECONFIG
+    default: ""
+    documentation: "Path to kubeconfig for the target cluster."
+  credentials:
+  - namespace: test-credentials
+    name: registry-pull-credentials
+    mount_path: /var/run/ci-registry
+  resources:
+    requests:
+      cpu: 100m
+      memory: 200Mi
+  timeout: 10m0s
+  documentation: |-
+    Merges CI build registry credentials into the target cluster's global
+    pull-secret so that pods can pull images from the CI pipeline registry.
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/OWNERS b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/OWNERS
new file mode 100644
index 0000000000000..42fcae862b9e3
--- /dev/null
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/OWNERS
@@ -0,0 +1,7 @@
+approvers:
+- eifrach
+- ccardenosa
+- mrniranjan
+- rshemtov13
+- sargunnarula
+- oblau
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.metadata.json b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.metadata.json
new file mode 100644
index 0000000000000..b708a024fd006
--- /dev/null
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.metadata.json
@@ -0,0 +1,13 @@
+{
+	"path": "telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml",
+	"owners": {
+		"approvers": [
+			"eifrach",
+			"ccardenosa",
+			"mrniranjan",
+			"rshemtov13",
+			"sargunnarula",
+			"oblau"
+		]
+	}
+}
\ No newline at end of file
diff --git a/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml
new file mode 100644
index 0000000000000..2d02da2436c44
--- /dev/null
+++ b/ci-operator/step-registry/telcov10n/functional/cnf-compute/nrop/tls-scanner/telcov10n-functional-cnf-compute-nrop-tls-scanner-workflow.yaml
@@ -0,0 +1,25 @@
+workflow:
+  as: telcov10n-functional-cnf-compute-nrop-tls-scanner
+  steps:
+    pre:
+    - ref: telcov10n-functional-cnf-compute-nrop-process-inventory
+    - ref: telcov10n-functional-cnf-compute-nrop-ocp-deploy
+    - ref: telcov10n-functional-cnf-compute-nrop-ocp-operators
+    - ref: telcov10n-functional-cnf-compute-nrop-configure
+    - ref: telcov10n-functional-cnf-compute-nrop-merge-ci-credentials
+      env:
+      - name: KUBECONFIG
+        default: "/tmp/shared/kubeconfig"
+    test:
+    - ref: tls-scanner-run
+    post: []
+  documentation: |-
+    NROP TLS scanner workflow for ML-KEM (Post-Quantum Cryptography) validation.
+
+    Deploys OCP cluster, installs and configures NROP operator, then runs TLS scanner
+    with TLS_SCANNER_PQC_PASS=true to validate ML-KEM support. Does NOT run functional tests.
+
+    TLS scanner results are automatically saved to ARTIFACT_DIR as JUnit XML and
+    rendered by Spyglass. Job pass/fail is determined by the scanner pod exit code.
+
+    For full e2e testing with functional tests, use telcov10n-functional-cnf-compute-nrop-testing.